Update Framework to Rails 7.2

[awilfox]

• Rails.application.secrets is removed; the secret_key_base accessor in Rails.application has been present since 6.x, so just use that.

• Minor configuration updates for 7.2 defaults.

• Add mutex_m to avoid deprecation warnings for Ruby 3.4.

Ref: AP-270

---

This includes the SECRET_KEY_BASE setting in build.yml that @danschmidt5189 suggested in Slack, so cc'ing him.

Only other thing of note is that Rails 7.2 enforces HTTPS (HSTS / redirects) in prod, but this shouldn't be an issue since AFAIK all Library endpoints are HTTPS anyway.

[danschmidt5189]

A few minor questions but definitely not blockers.

[danschmidt5189]

Do you know how this behaves behind a proxy that terminates SSL? X-Forwarded-Proto would be https, but the actual connection to the proxy is http.

[awilfox]

AVPlayer and Lost-and-Found both have config.force_ssl enabled, so it should be fine here AFAIK.

[Copilot]

Pull request overview

Updates the application to Rails 7.2, aligning configuration defaults and dependency versions while addressing deprecations (notably Rails.application.secrets removal and Ruby 3.4 warnings).

Changes:

• Upgrade Rails from 7.1 to 7.2 (and update Gemfile/Gemfile.lock accordingly, including adding mutex_m).
• Update environment and framework configuration defaults (e.g., load_defaults 7.2, SSL enforcement in production, test/development config tweaks).
• Adjust CI and tooling scripts (GitHub Actions build workflow, docker-compose CI overrides, simplified binstubs).

Reviewed changes

Copilot reviewed 11 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
public/robots.txt	Updates documentation URL to HTTPS.
docker-compose.ci.yml	Adds a CI mount intended to provide SECRET_KEY_BASE.
config/puma.rb	Replaces Puma config comments and adds pidfile support.
config/environments/test.rb	Enables deprecation logging to stderr; comment updates.
config/environments/production.rb	Enables force_ssl and adds Rails 7.2 production defaults.
config/environments/development.rb	Comment/style tweaks; adds Action Mailer template caching setting.
config/boot.rb	Removes explicit require 'logger'.
config/application.rb	Switches load_defaults to 7.2 and adds autoload_lib ignore list.
bin/rubocop	Replaces Bundler-generated binstub with a simplified wrapper and forces explicit config path.
bin/brakeman	Replaces Bundler-generated binstub with a simplified wrapper and adds --ensure-latest.
app/models/efees_invoice.rb	Migrates from Rails.application.secrets to Rails.application.secret_key_base.
Gemfile.lock	Locks Rails 7.2.3 and related dependency updates (including mutex_m).
Gemfile	Bumps Rails requirement to 7.2.3 and adds mutex_m.
.idea/altmedia.iml	Updates IDE module metadata for new gem versions.
.github/workflows/build.yml	Generates a secret key base file during CI stack setup.

Files not reviewed (1)

• .idea/altmedia.iml: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Mounting /tmp/secret_key_base at /run/secrets/SECRET_KEY_BASE won’t affect Rails unless something reads that file and sets ENV["SECRET_KEY_BASE"] (no such logic exists in this repo). If the intent is to satisfy Rails 7.2’s secret_key_base requirement in CI, pass SECRET_KEY_BASE as an environment variable to the container (and/or add boot-time code to read /run/secrets/SECRET_KEY_BASE).

[danschmidt5189]

Wrong -- the berkeley_library-docker gem automatically loads secrets from /run/secrets into ENV when the application boots.

[awilfox]

v2: Addressed feedback.